CAPEC-611 BitSquatting

An adversary registers a domain name one bit different than a trusted domain. A BitSquatting attack leverages random errors in memory to direct Internet traffic to adversary-controlled destinations. BitSquatting requires no exploitation or complicated reverse engineering, and is operating system and architecture agnostic. Experimental observations show that BitSquatting popular websites could redirect non-trivial amounts of Internet traffic to a malicious entity.

1. [Explore] [Determine target website] The adversary first determines which website to impersonate, generally one that is trusted and receives a consistent amount of traffic. 2. [Experiment] [Impersonate trusted domain] In order to impersonate the trusted domain, the adversary needs to register the BitSquatted URL. 3. [Exploit] [Wait for a user to visit the domain] Finally, the adversary simply waits for a user to be unintentionally directed to the BitSquatted domain.

• An adversary requires knowledge of popular or high traffic domains, that could be used to deceive potential targets.

• [Low] Adversaries must be able to register DNS hostnames/URL’s.

• Other: Other

• Authenticate all servers and perform redundant checks when using DNS hostnames. • When possible, use error-correcting (ECC) memory in local devices as non-ECC memory is significantly more vulnerable to faults.